Privacy Policy

Search.co is operated by Nead, LLC, an Arkansas limited liability company ("Search.co," "we," "us" or "our"). Our mailing address is 1425 Broadway #22689, Seattle, WA 98112, United States, and you can reach us at [email protected].

This policy covers personal data we handle through:

• search.co, our public website, including the Brigham.ai question box on the homepage, the blog, contact and demo forms, and the chat assistant;
• app.search.co, the Search.co application: SEO and AI-search research tools, rank and AI visibility tracking, site audits, content tools, AI PR outreach, social posting, ad tools, client reviews, reports, the API and the MCP server;
• search.co/research, our multi-agent research workspace;
• the free tools anyone can use without an account, and the emails we send.

It replaces our earlier policies published at search.co/privacy and search.co/privacy-policy. Our Terms of Service govern your use of the service and incorporate this policy.

For account, billing, website and marketing data, and for data we collect to run and secure the service, we are the controller.

When a customer uses Search.co to process personal data about other people, the customer is the controller and we act as its processor(or "service provider" under US state laws). Examples are the visitor and conversion data a customer's tracking pixel collects on the customer's own website, contact lists a customer uploads, and the recipients of a customer's reports. We process that data only on the customer's instructions. If your data reached us that way, please contact the customer first; we will help them respond to you.

For journalist and media contacts found on public web pages for the AI PR feature, see section 9.

Information you give us

• Account data. Your name and email address. On app.search.co you sign in with a one-time email link or with Google; there is no password. The research workspace at search.co/research also offers password sign-in (we store only a salted hash) and GitHub sign-in.
• Organization data.The organizations you create or join, your role, the members you invite, and client organizations an agency manages on a client's behalf.
• Content you submit. Domains, URLs, keywords, prompts, questions to Brigham, projects, focus pages and markets, briefs, drafts, pitches, social posts, uploaded files and lists, report settings and recipient addresses, and anything else you enter.
• Billing data. Plan, invoices and payment status. Card details go straight to Stripe; we never see or store full card numbers.
• Communications. Messages to support, contact and demo forms, and conversations with the chat assistant on search.co.
• Keys you add.API keys for your own AI providers or data sources ("bring your own key") in the research workspace. They are encrypted at rest with AES-256-GCM and never shown again after saving.

Information from accounts you connect

Only if you choose to connect them. Each is described in section 7 (Google), section 8 (Microsoft) and section 10 (other services).

Information collected automatically

• Log and device data. IP address, browser and device type, pages requested, referring URL, timestamps and error reports.
• Usage data. Which tools you run, credits spent, the cost of each lookup, and audit-log entries of changes made in your organization.
• Cookies. Described in section 12.
• Free-tool and Brigham visitors. To enforce free-use limits we store a keyed hash (HMAC) of your IP address and of a random browser identifier, not the raw IP, together with the tool, the input and the outcome. Cloudflare Turnstile checks that requests come from a person.

Information from third parties and public sources

• Search and web data. Search engine results, keyword metrics, backlink and domain data, ad libraries, AI assistant answers and public web pages, which can contain names or details of people who publish online.
• Public media data. Published articles and author bylines (for example from the GDELT Project) and journalist contact details found on public pages, for AI PR.
• Partners. If an agency or DEV.co sets up an account for you, they give us your name and email.

• To create and secure your account, sign you in and manage organizations and members.
• To provide the tools you run: fetching search, keyword, backlink, ad and AI-answer data; scanning pages; generating reports, plans, drafts and pitches with AI models; sending what you ask us to send.
• To run scheduled work you set up, such as rank tracking, alerts, monthly client reviews and digests.
• To meter credits, bill you and handle payment problems.
• To send service emails: sign-in links, receipts, alerts, reports and notices about changes. Marketing emails only where the law allows, with an unsubscribe link in each.
• To answer support requests and route new sign-ups to our sales team's CRM.
• To prevent fraud, abuse and spam, enforce limits and our Terms, and keep the service secure.
• To debug, measure performance and improve the service using aggregated or de-identified data.
• To comply with law and respond to lawful requests.

We do not sell personal data, and we do not use your content or connected-account data to train AI models.Under their API terms, our AI providers don't train their models on data we send them.

Where the GDPR or UK GDPR applies, we rely on:

• Contract: to provide the service you signed up for and bill for it.
• Legitimate interests: to secure and improve the service, prevent abuse, run the free tools, follow up with business sign-ups, and, for AI PR, to let customers contact journalists about stories in their field using professional details those journalists have made public. We balance these interests against your rights and give you an easy way to object.
• Consent: for connecting third-party accounts and for marketing where consent is required. You can withdraw consent at any time.
• Legal obligation: for tax, accounting and lawful requests.

Brigham, client reviews, content tools, pitch drafts, AI visibility checks and the research workspace send the relevant parts of your content (for example a page's text, a keyword, your question, or results we fetched) to AI model providers to produce output. Depending on the feature these include Anthropic (Claude), OpenAI, Google (Gemini), Perplexity and, for image, audio and video generation, providers such as fal.ai, ElevenLabs, HeyGen and Kling. In the research workspace you can choose providers and use your own keys, in which case the provider's own terms apply to that traffic.

AI visibility tools ask AI assistants questions about brands and topics you choose, and store the answers and citations. AI output can be inaccurate; see our Terms.

We do not use data received from Google or Microsoft accounts you connect to train or improve any AI or machine-learning model, ours or anyone else's.

Search.co's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You choose whether to connect Google. Each connection asks only for these scopes:

Sign in with Google

• openid, email, profile.To confirm your identity and verified email address and show your name. We don't receive your Google password.

Search Console and Google Analytics (projects and client reviews)

• openid, email: to label the connection with the Google account that granted it.
• https://www.googleapis.com/auth/webmasters.readonly: read-only access to the Search Console properties you select, to show clicks, impressions, average position and queries for your sites and to lead your client reviews with them.
• https://www.googleapis.com/auth/analytics.readonly: read-only access to the Google Analytics 4 properties you select, to show traffic, audience and conversion reports for your sites.

We never change anything in Search Console or Analytics.

Gmail (AI PR pitches)

• openid, email, profile: to show which mailbox is connected as a sender.
• https://www.googleapis.com/auth/gmail.send: to send the pitch emails you write and approve, from your own address, to the journalists you choose. We can't read your inbox with this scope.
• https://www.googleapis.com/auth/gmail.metadata (only if reply tracking is enabled): to read message headers (sender, recipients, subject, date and thread ID), never message bodies or attachments, so we can tell you when a journalist replies to a pitch and stop follow-ups to them. We look only at threads started by pitches sent through Search.co.

Google Ads (if you connect an ad account)

• https://www.googleapis.com/auth/adwords: to read campaign performance and, within the automation settings you choose, adjust budgets or campaigns in the ad accounts you connect.

How we handle Google user data

• We use it only to provide and improve the user-facing features described above, for you.
• We do not sell it, use it for advertising, retargeting or interest-based ads, or use it to determine credit worthiness or for lending.
• We do not use it to develop, improve or train generalized or non-personalized AI or machine-learning models.
• Humans don't read it, except with your explicit consent for a specific message or report (for example a support request), where needed for security or abuse investigations, or to comply with law.
• We transfer it only to the subprocessors needed to provide those features (hosting, database and, when you ask for an AI summary or plan, the AI provider that writes it), under contracts consistent with these rules, or as required by law or in a merger or acquisition with notice to you.
• OAuth tokens are encrypted at rest and used only by our servers.

Revoking access and deletion

Disconnect Google at any time from the connection's page in app.search.co (project settings for Search Console and Analytics, AI PR senders for Gmail) or at myaccount.google.com/permissions. When you disconnect Search Console or Analytics in the app, we revoke the grant with Google (unless another of your organizations still uses the same Google account), delete the stored tokens and delete the Google data we imported for your projects. Disconnecting a Gmail sender deletes its stored tokens. Reports you already generated stay in your account until you delete them or your organization is deleted (section 14). To ask us to delete Google data sooner, email [email protected].

If you connect an Outlook or Microsoft 365 mailbox as an AI PR sender, we request these Microsoft Graph permissions:

• openid, email, profile, User.Read: to identify the connected mailbox.
• offline_access: to keep sending scheduled pitches and follow-ups without asking you to sign in each time.
• Mail.Send: to send the pitches you approve from your address.
• Mail.ReadBasic: to read message headers and senders, never bodies or attachments, to detect replies to pitches.

We handle Microsoft data under the same rules as Google data in section 7: used only for these features, never sold, never used for ads or AI training, tokens encrypted at rest. Remove access in app.search.co or at myaccount.microsoft.com under app permissions.

The AI PR feature helps customers find journalists who cover their field and send them pitches. If you are a journalist or media contact, here is what that means for you.

• What we hold. Your name, outlet, beat, published articles and a work email address. Addresses come from public web pages (such as an author page or masthead) or are added by a customer manually or by import. We record where each address came from.
• Why. So customers can send you relevant story pitches (legitimate interests, section 5). Pitches are written and approved by the customer and sent from the customer's own mailbox, so the customer is responsible for their content.
• Your notice and choices. Every pitch includes a link to a page that tells you where your address came from (as GDPR Article 14 requires) and lets you either stop pitches from that customer, or stop all pitches sent through Search.co. One-click unsubscribe in your mail client counts as stopping that customer.
• Global opt-out.If you stop all pitches, we delete your address from every customer's journalist lists and keep only a keyed one-way hash of it, so we can block it from being added again.
• You can also email [email protected] to object, access or delete your data.

• LinkedIn and X. If you connect them to schedule posts, we request permission to identify you and post on your behalf (LinkedIn: openid, profile, w_member_social and, for company pages you manage, w_organization_social, r_organization_social, rw_organization_admin; X: tweet.read, tweet.write, users.read, media.write, offline.access). We post only what you schedule and read post statistics to show you results.
• Ad platforms. If you connect Meta, LinkedIn or TikTok ad accounts, we read campaign data and make changes within the automation settings you choose.
• GitHub. In the research workspace, if you connect GitHub we write research output to the repositories you authorize.

Disconnect any of them in app.search.co or in that service's settings; we then delete the stored tokens.

We share personal data only as follows:

• Within your organization.Members of an organization see its projects, reports and activity. Agencies managing a client organization see that client's data, and the client sees work done in it.
• With people you choose. When you send a report, share link or pitch, the recipients see it.
• With service providers (subprocessors) who process data for us under contract:
  • Hosting and infrastructure: Hetzner Online (servers and databases in Germany), Cloudflare (network, security, Turnstile), object storage, and error monitoring (Sentry).
  • Payments: Stripe.
  • Email delivery: Resend and SendGrid.
  • Search and web data: DataForSEO (search results, keyword, backlink and ad data, sent the keywords, domains and locations you look up), Google PageSpeed Insights and Chrome UX Report, the YouTube Data API, Meta and LinkedIn ad libraries, the GDELT Project, Wikidata and Wikimedia, and OpenStreetMap Nominatim (to turn city names into map points).
  • AI providers listed in section 6.
  • Our affiliates DEV.co and erp.io, which provide the chat assistant on search.co and the CRM our team uses for new sign-ups and sales follow-up.
• For legal reasons. To comply with law, enforce our Terms, or protect the rights, property or safety of anyone.
• In a business transfer. If we are involved in a merger, acquisition or sale of assets, subject to this policy.

An up-to-date list of subprocessors is available on request.

We use a small number of cookies, all first-party and needed for the service to work:

• Session (for example __roi_sessionand the research workspace's session cookie): keeps you signed in.
• Sign-in and connection flows (such as __search_google_oauth, __search_pr_mail_oauth, __search_social_oauth): short-lived cookies that protect OAuth sign-ins and connections against forgery.
• Free-tool visitor (__sco_guest): a random identifier used to apply free-use limits.
• Preferences: your light or dark theme, stored in your browser.
• Security: Cloudflare and Turnstile may set cookies to detect bots.

The chat assistant on search.co is loaded from phony.erp.io and stores the conversation so it can continue. We don't use third-party advertising cookies on search.co or app.search.co. Customers who install our conversion pixel on their own sites are responsible for the notices and consent those sites need.

We are based in the United States and our servers are in Germany. Some providers process data in the United States and other countries. Where we transfer personal data out of the EEA, UK or Switzerland to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum) or another lawful mechanism, with additional safeguards where needed.

• Account and organization content: while your account or organization is active. When an organization is deleted, its data is held for 30 days (so an accidental deletion can be reversed) and then permanently purged, along with its files and events.
• Connected-account tokens: until you disconnect, or the organization is deleted.
• Individual results (scans, lookups, drafts, reports): until you delete them or the organization is deleted. Some raw data is pruned sooner, for example daily search results used for volatility tracking after 35 days.
• Billing records: as long as tax and accounting law requires, typically up to seven years.
• Logs and free-tool records: as long as needed for security, abuse prevention and debugging.
• Global PR opt-outs: the keyed hash is kept indefinitely so the opt-out keeps working.

We use TLS in transit, encryption at rest for credentials, OAuth tokens and keys you provide, role-based access within organizations, audit logs, bot protection, restricted server access and firewalls. No system is perfectly secure; if we learn of a breach affecting your personal data we will notify you and regulators as the law requires. Report vulnerabilities to [email protected].

Depending on where you live, you may have the right to:

• access the personal data we hold about you and get a copy in a portable format;
• correct inaccurate data;
• delete your data;
• restrict or object to processing, including processing based on legitimate interests and direct marketing;
• withdraw consent at any time, without affecting earlier processing;
• lodge a complaint with your data protection authority.

Email [email protected]from the address on your account. We may need to verify your identity, and will respond within the time the law requires (one month under the GDPR, 45 days under US state laws). You can also edit your profile, remove members, disconnect accounts and delete your organization in app.search.co settings. If your data is in a customer's account, we will forward your request to them.

Under the California Consumer Privacy Act (as amended by the CPRA) and similar laws in other states, residents have the rights in section 16, plus the right to know the categories of data collected and to non-discrimination for exercising their rights.

• Categories collected in the last 12 months: identifiers (name, email, IP address), commercial information (plan and purchases), internet activity (usage and logs), professional information (for business users and journalists), and inferences limited to product use. Sources and purposes are in sections 3 and 4.
• No sale or sharing. We do not sell personal information or share it for cross-context behavioral advertising, and have not done so in the last 12 months.
• Sensitive information. We do not use sensitive personal information to infer characteristics about you.
• You can use an authorized agent; we may ask them for proof of authority.

Search.co is a business service for people 18 and older. We don't knowingly collect data from children under 16. If you believe a child has given us personal data, contact us and we will delete it.

We may update this policy. We will change the "Last updated" date and, for material changes, notify account owners by email or in the app before the change takes effect.

Nead, LLC (Search.co), 1425 Broadway #22689, Seattle, WA 98112, United States.
Email: [email protected]